Monitor current usage of Searchable Storage (DDAS)
This dashboard shows comprehensive Dynamic Data Active Searchable (DDAS) license usage data so Splunk Cloud Platform administrators can ensure their organization stays within its licensed subscription limits.
About the Searchable Storage (DDAS) dashboard
Dynamic Data Active Searchable (DDAS) is used for searching ingested data. DDAS is also commonly known as searchable storage. Review the information to ensure that you are staying within your subscribed limits for data ingestion and retention. The displayed data updates every time you access or refresh the dashboard in the CMC app. For more information, see Restore archived data to Splunk Cloud Platform.
Your organization determines their DDAS entitlement amount when subscribing to the Splunk Cloud Platform. For questions about your organization's DDAS entitlement, contact your Splunk account representative. See also the "Data retention" and "Dynamic Data Active Searchable (DDAS)" sections in the Storage section of the Splunk Cloud Platform Service Description.
Review the Searchable Storage (DDAS) dashboard
To investigate your panels, go to Cloud Monitoring Console > License Usage > Searchable Storage (DDAS).
| Panel | Description |
|---|---|
| Searchable Storage (DDAS) Entitlement | Shows the amount of your searchable storage entitlement.
If you are an ingest-based customer, this value includes any additional storage you have purchased. If you are a workload-based customer, this value is the storage you have purchased. For questions about these entitlement values, contact your Splunk account representative. |
| Searchable Storage Usage | Shows the amount of searchable storage used by customer-created and metered internal indexes in GB.This value includes only actively searched storage and is calculated when you load this dashboard. Though this value will generally correspond to the total of the individual index values displayed in the Searchable Storage Index Details table, there may be differences due to the time the queries are performed, data aging out of indexes, and similar reasons.
Use this information to compare your current storage consumption against your subscription entitlement and data retention limits. |
| Searchable Storage Usage Percent | Shows your percentage of usage compared to your DDAS license entitlement.
The value displays in the following colors to indicate status:
|
| Restored Entitlement | Shows your entitlement limit for DDAA restores. For most Splunk Cloud Platform customers, this value is generally 10% of the amount that displays in the Searchable Storage (DDAS) Entitlement panel. If your organization has has expanded their license to increase restoring capacity, the restored entitlement limit reflects this increase up to 20%. For more information, see the following:
If your organization doesn't have a DDAA subscription, this panel doesn't appear. |
| Restored Searchable Storage (DDAS) Usage | Shows the amount of restored storage used by both customer-created and metered internal indexes. This panel calculates searchable storage as the amount of restored data minus the expired and cleared data.
If your organization doesn't have a DDAA subscription, this panel doesn't appear. |
| Restored Searchable Storage (DDAS) Usage Percent | Shows the percentage of restored data usage compared to your restored storage entitlement.
If your organization doesn't have a DDAA subscription, this panel doesn't appear. |
| Searchable Storage Usage Against Entitlement | Shows the amount of searchable storage used by all applicable indexes compared to your entitlement limit.
This bar chart is the visualization for the Searchable Storage Usage panel. |
| Searchable Storage Usage by Top 10 Indexes | Shows the top 10 indexes that are high consumers of searchable storage.
Select the Include Internal Indexes checkbox to include Splunk internal indexes in the chart and analyze if internal indexes are consuming high amounts of storage. See also the Splunk Internal Index Details table. |
| Searchable Storage Index Details | Provides a tabular overview of searchable storage details per index that includes the following data:
Shows a table of the indexes in your deployment and the current searchable amount in GB for each actively searchable index. The searchable indexes of your deployment only include those in a hot or warm bucket. The GB value that displays for each index is calculated when you load this dashboard. Use this information to determine which indexes are high consumers of storage, and also understand general usage patterns and trends. For more information about index retention settings, see Manage data retention settings in the Splunk Cloud Platform Admin Manual. |
| Splunk Internal Index Details | Provides a tabular overview of internal index details that includes the following data:
Splunk internal indexes can be identified by the underscore prefix (_) in the index name and appear on other storage dashboards, such as the Storage Summary dashboard. You can opt to include internal indexes in the Searchable Storage Usage by Top 10 Indexes chart. An index with a storage value that exceeds the default value delivered by Splunk consumes additional license data. The Default Retention Days column shows Splunk default values. The Storage Retention Days column shows the actual storage retention value set for an index. |
Interpret your searchable storage results
- A good method to determine if your data usage is running higher than expected is to check the dates of the earliest and latest events and compare this time period to the retention setting for the individual index. For example, if the earliest event is 2020/01/25, the latest event is 2020/01/31, and the retention setting for the index is 90 days, then the data ingestion for the index was met long before the time retention setting was met. So, the data ingestion was greater than anticipated.
- If an internal index displays a Storage Retention Days value that exceeds the Default Retention Days value, contact your Splunk account representative.